CVE-2026-9808: Mautic API Authorization Bypass Flaw

CVE-2026-9808 Overview

CVE-2026-9808 is an authorization bypass vulnerability in Mautic 7 API v2 endpoints built on API Platform. The flaw allows low-privilege authenticated users to bypass owner-scope restrictions and access or modify resources owned by other users. Roles configured with viewown or editown permissions fail to enforce ownership checks consistently across API v2 routes. This breaks the tenant isolation that Mautic administrators rely on to restrict marketing data access. The vulnerability is tracked under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated API users with restricted roles can read and modify contacts, campaigns, and other resources belonging to other users, breaking ownership-based access controls.

Affected Products

Mautic 7 (API v2 endpoints using API Platform)
Installations relying on viewown role-based access control
Installations relying on editown role-based access control

Discovery Timeline

2026-05-29 - CVE-2026-9808 published to NVD
2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-9808

Vulnerability Analysis

Mautic is an open-source marketing automation platform that exposes a REST API for managing contacts, campaigns, segments, and related entities. The API v2 layer uses API Platform, a PHP framework that auto-generates CRUD endpoints from Doctrine entities. Mautic ships a permission model that supports owner-scoped roles, where users granted viewown or editown can only act on records they personally created.

The vulnerability stems from incomplete enforcement of ownership checks within the API v2 request lifecycle. While the legacy API and UI layers evaluate the record owner before returning or persisting data, API v2 routes process requests without consistently applying the same owner-scope filter. As a result, an authenticated user holding only viewown or editown privileges can retrieve or alter records belonging to other users.

The issue maps to CWE-863: Incorrect Authorization. Authentication still succeeds, and role checks gate the endpoint itself, but the per-record ownership decision is not enforced before the requested operation executes.

Root Cause

API Platform generates endpoint handlers from entity metadata. Mautic's owner-scope logic lives in custom voters and repository filters that the legacy controllers invoke explicitly. The v2 endpoints do not chain through those voters, so ownership predicates never reach the Doctrine query. Records are returned or written based on entity-level role grants alone.

Attack Vector

An attacker needs valid API credentials for an account with viewown or editown permissions. The attacker sends authenticated HTTP requests to API v2 endpoints, supplying identifiers for resources owned by other users. The server returns or mutates the targeted records despite the ownership mismatch. Exploitation requires no user interaction and runs over the network.

For technical specifics, refer to the Mautic GitHub Security Advisory GHSA-2jrw-c95w-h43g.

Detection Methods for CVE-2026-9808

Indicators of Compromise

API v2 requests from low-privilege accounts referencing resource IDs they did not create
Spikes in GET or PATCH calls to /api/contacts, /api/campaigns, or related v2 endpoints from a single user token
Audit log entries showing modifications to records whose createdBy field does not match the authenticated user
Lateral access patterns where one API key reads or edits records across multiple owner accounts

Detection Strategies

Correlate API access logs with Mautic's createdBy ownership metadata to flag mismatches
Baseline API v2 usage per user role and alert on volume or scope deviations
Inspect Authorization headers and token-to-owner mappings during request review
Monitor for enumeration patterns where sequential resource IDs are queried by the same caller

Monitoring Recommendations

Enable verbose access logging on the Mautic application server and forward to a centralized SIEM
Alert on API v2 responses returning records whose owner differs from the requesting user
Track failed and successful authorization decisions per endpoint to spot bypass attempts
Review API token issuance and revoke tokens issued to accounts that no longer require API access

How to Mitigate CVE-2026-9808

Immediate Actions Required

Apply the upstream Mautic patch referenced in the GitHub Security Advisory GHSA-2jrw-c95w-h43g as soon as it is available for your release
Audit accounts assigned viewown or editown roles and revoke API access where it is not required
Rotate API credentials for any account suspected of accessing data outside its ownership scope
Review audit logs since the deployment of Mautic 7 API v2 for cross-owner record access

Patch Information

Refer to the Mautic GitHub Security Advisory GHSA-2jrw-c95w-h43g for the fixed version and upgrade guidance. Upgrade Mautic to the patched release that restores owner-scope enforcement across API v2 endpoints.

Workarounds

Restrict API v2 access at the web server or reverse proxy until the patch is applied
Temporarily replace viewown and editown roles with stricter role definitions that limit API exposure
Disable API access for accounts that do not require programmatic integration
Place the Mautic API behind an authenticated gateway that enforces additional per-user resource scoping

bash

# Example nginx restriction to block API v2 access until patched
location /api/ {
    deny all;
    return 403;
}